github - ghsa-7w9x-rg6m-2fh9

GHSA-7W9X-RG6M-2FH9

Vulnerability from github – Published: 2022-05-13 01:54 – Updated: 2022-05-13 01:54

Details

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

Severity ?

5.9 (Medium)


                  
                    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-4300"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-03T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.",
  "id": "GHSA-7w9x-rg6m-2fh9",
  "modified": "2022-05-13T01:54:03Z",
  "published": "2022-05-13T01:54:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4300"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apple/cups/releases/tag/v2.2.10"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107785"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2018-4300 (GCVE-0-2018-4300)

Vulnerability from cvelistv5 – Published: 2019-04-03 17:54 – Updated: 2024-08-05 05:11

Summary

Severity ?

No CVSS data available.

CWE

A maliciously crafted web site or local HTML file might be able to collect sanitized job and printer status information without the knowledge of the user

Assigner

apple

References

URL

Tags

	https://github.com/apple/cups/releases/tag/v2.2.10	x_refsource_MISC
	http://www.securityfocus.com/bid/107785	vdb-entryx_refsource_BID
	https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	CUPS	Affected: Versions prior to: v2.2.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T05:11:22.271Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apple/cups/releases/tag/v2.2.10"
          },
          {
            "name": "107785",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107785"
          },
          {
            "name": "[debian-lts-announce] 20190928 [SECURITY] [DLA 1936-1] cups security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CUPS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Versions prior to: v2.2.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A maliciously crafted web site or local HTML file might be able to collect sanitized job and printer status information without the knowledge of the user",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-28T11:06:05",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apple/cups/releases/tag/v2.2.10"
        },
        {
          "name": "107785",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107785"
        },
        {
          "name": "[debian-lts-announce] 20190928 [SECURITY] [DLA 1936-1] cups security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2018-4300",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CUPS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions prior to: v2.2.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A maliciously crafted web site or local HTML file might be able to collect sanitized job and printer status information without the knowledge of the user"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/apple/cups/releases/tag/v2.2.10",
              "refsource": "MISC",
              "url": "https://github.com/apple/cups/releases/tag/v2.2.10"
            },
            {
              "name": "107785",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107785"
            },
            {
              "name": "[debian-lts-announce] 20190928 [SECURITY] [DLA 1936-1] cups security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2018-4300",
    "datePublished": "2019-04-03T17:54:23",
    "dateReserved": "2018-01-02T00:00:00",
    "dateUpdated": "2024-08-05T05:11:22.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-7W9X-RG6M-2FH9

CVE-2018-4300 (GCVE-0-2018-4300)

Tags

Sightings

Nomenclature